Document the WYSIWYG XSS filtering concept and architecture for developers

Problem

• The security concept and overall architecture of #2099741: Protect WYSIWYG Editors from XSS Without Destroying User Data is not documented anywhere, aside from that issue's summary.

Goal

• As a developer who (1) is experiencing a "weird" behavior of HTML tags suddenly being removed out of nowhere or (2) who wants to write code that happens to have to integrate with the front-end XSS security concept, I want to be able to find and read a bird-level description of the architectural concept, so that I can understand it and be sure that I'm not doing Something Completely Stupid™. :-)